Hacker News new | ask | show | jobs
by Daviey 921 days ago
The Github action leaked the creds, seemingly via a log. Looks like that action has been in use for ~4 months.
3 comments

This is exactly why GitHub support OpenID Connect, https://docs.github.com/en/actions/deployment/security-harde..., so that long-lived secrets don't need to be present as part of the build.

I'm not sure if NPM supports OIDC, which would be ironic given that both GitHub and NPM are owned by Microsoft.

Why would that be ironic?
Sorry, my sentence was poorly written, I meant it would be ironic if NPM didn't support OIDC.
Automated publishing without a human involved kind of kills the whole point of 2FA anyway.

It is kind of funny that the crypto world of multi sigs relies on blind trust of unverified UI components.

Technically, it is just the frontends. You can always interact with the contracts directly and that can't ever be shut down (if you know what you're doing). Can you do that with your bank?

Let's also not forget that every other website on the planet that relies on npm also relies on the blind trust of unverified UI components. This isn't just silo'd to crypto.

> Let's also not forget that every other website on the planet that relies on npm also relies on the blind trust of unverified UI components.

It feels like you think you're making a really good point here. In reality, it's just a run-of-the-mill appeal to popularity. The programmers doing this sort of thing on other websites are in the wrong, too.

If properly configured and audited, this approach can be secure. Github is the only way configured to publish to NPM, and NPM pushes can only be initiated by signed commits from trusted accounts with MFA, the entire workflow is can be secure on its own.

I don't really see the point for a project that doesn't seem to update their code all that often, though. The risk of misconfiguring something doesn't seem worth the effort saved by having someone with a 2FA key upload a tarball generated on their dev machine.

Source?

Their twitter says "This morning CET, a former Ledger Employee fell victim to a phishing attack that gained access to their NPMJS account."

And Github Actions automatically redacts the secret in the log

You are right, I should have waited for the postmortem.. it appeared the likely way because the secret was in the release pipeline env.

However.. something doesn't add up. There is no chance that a malicious actor gained access and in a couple of hours put together this exploit. Or, I can't see someone putting together this exploit, THEN trying to spear-phish in hope of getting lucky and pressing the button.

> I can't see someone putting together this exploit, THEN trying to spear-phish in hope of getting lucky and pressing the button.

How can you not see someone doing that? The effort netted them $600k.

Is this not how exploits work? Build the exploit and then try to use it by finding an "in." They don't find an "in" and then build the exploit.